@synopackageland/templates 0.40.3 → 0.40.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.40.4
+
+- Ignore private environment variants, key and certificate files, and npm credentials in every scaffold while keeping `.env.example` trackable
+- Include placeholder-only environment examples for the optional AI tests
+- Document secret storage under `synology/` for upstream forks without changing upstream ignore files
+- Verify Git ignore behavior for every template and UI variant, including upstream forks, using the packed templates and actual CLI
+
 ## 0.40.3
 
 - Use CLI architecture names in local package tests and SDK constants in background-limit assertions

package/README.md

@@ -354,6 +354,32 @@ configuration and DSM service definition, and upgrades retain the selection.
 Changing ports uses reinstall. Declare `{port: gateway_https}` runtime bindings
 when an upstream application needs its public port in its own configuration.
 
+## Secret files
+
+Every scaffold ignores `.env`, `.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`
+at any depth within its project. `.env.example` remains trackable and contains
+only placeholders for the optional AI tests; those commands load `.env` from
+their working directory. Copy the example only when configuring those tests.
+Keep real credentials out of examples and commits.
+
+Templates ship ignore files as `gitignore` because npm excludes `.gitignore`;
+`synopkgland init` restores the `.gitignore` name in the generated project.
+The scaffold tests use the actual packed templates to verify that behavior.
+
+### Upstream fork secret storage
+
+For `init --upstream-fork`, all wrapper-owned files belong in `synology/`.
+Store secrets in **`synology/.env`, never the fork root**, and run the optional
+tests from `synology/`. Copy `synology/.env.example` only when configuring the
+optional AI tests. Keep keys, certificates and private npm configuration under
+`synology/` as well.
+
+The upstream root `.gitignore` is not ours to edit and may not ignore a root
+`.env`. The generated `synology/.gitignore` protects secrets inside `synology/`;
+it cannot protect files in the parent directory. Preserve upstream ignore files
+and history. Use the CLI's `synopkgland skill show upstream-fork` for the rest of
+the fork workflow.
+
 ## App-open smoke
 
 Every generated project includes `tests/e2e/smoke.e2e.ts`, `e2e.config.ts` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.40.3",
+  "version": "0.40.4",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/binary/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/binary/README.md

@@ -2,6 +2,8 @@
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/binary/gitignore

@@ -4,3 +4,9 @@ dist/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/compose/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/compose/README.md

@@ -2,6 +2,8 @@
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh
@@ -14,3 +16,12 @@ After committing the generated root lockfile, use `npm ci --include=dev`.
 Configure the upstream image and its real readiness endpoint before
 `test:local`; see `AGENTS.md` for the Compose packaging workflow.
 
+## Secrets in an upstream fork
+
+With `--upstream-fork`, store secrets in `synology/.env`, never in the fork root.
+Run the optional tests from `synology/`; its `.gitignore` protects `.env`,
+`.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`, while `.env.example` remains
+trackable with placeholders only. The upstream root `.gitignore` is not ours
+to edit and may not ignore a root `.env`.
+See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#upstream-fork-secret-storage).
+

package/templates/compose/gitignore

@@ -1,5 +1,11 @@
 node_modules/
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc
 dist/
 *.spk

package/templates/native-go/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-go/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh
@@ -44,6 +46,15 @@ Before `npm run test:local`, prepare the backend and, for Vue, build the
 frontend using the steps below and the backend section in `AGENTS.md`, then
 run `synopkgland ctl generate`.
 
+## Secrets in an upstream fork
+
+With `--upstream-fork`, store secrets in `synology/.env`, never in the fork root.
+Run the optional tests from `synology/`; its `.gitignore` protects `.env`,
+`.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`, while `.env.example` remains
+trackable with placeholders only. The upstream root `.gitignore` is not ours
+to edit and may not ignore a root `.env`.
+See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#upstream-fork-secret-storage).
+
 ## Quick start
 
 Needs Node.js with `synopkgland` installed, and Go 1.26.10.

package/templates/native-go/gitignore

@@ -3,3 +3,9 @@ dist/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-go-vue/README.md

@@ -9,6 +9,8 @@ files, portal, jobs and delegate components come from `@synopackageland/sdk/vue`
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh
@@ -22,6 +24,17 @@ Before `npm run test:local`, prepare the backend and, for Vue, build the
 frontend using the steps below and the backend section in `AGENTS.md`, then
 run `synopkgland ctl generate`.
 
+## Secrets in an upstream fork
+
+With `--upstream-fork`, store secrets in `synology/.env`, never in the fork root.
+Run the optional tests from `synology/`; its `.gitignore` protects `.env`,
+`.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`, while `.env.example` remains
+trackable with placeholders only. The upstream root `.gitignore` is not ours
+to edit and may not ignore a root `.env`.
+See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#upstream-fork-secret-storage).
+
+## Frontend
+
 ```sh
 cd frontend
 npm ci --include=dev

package/templates/native-go-vue/gitignore

@@ -4,3 +4,9 @@ node_modules/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-node/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-node/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-node/gitignore

@@ -6,3 +6,9 @@ backend/app/*.js
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-node-vue/README.md

@@ -9,6 +9,8 @@ delegate components come from `@synopackageland/sdk/vue` (types from
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-node-vue/gitignore

@@ -6,3 +6,9 @@ backend/app/*.js
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-python/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-python/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-python/gitignore

@@ -4,3 +4,9 @@ __pycache__/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-python-vue/README.md

@@ -9,6 +9,8 @@ delegate components come from `@synopackageland/sdk/vue` (types from
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-python-vue/gitignore

@@ -5,3 +5,9 @@ node_modules/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-rust/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-rust/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-rust/gitignore

@@ -4,3 +4,9 @@ backend/target/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-rust-vue/README.md

@@ -9,6 +9,8 @@ delegate components come from `@synopackageland/sdk/vue` (types from
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-rust-vue/gitignore

@@ -5,3 +5,9 @@ backend/target/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc